Typical gas turbine engine fuel supply systems include a fuel source, such as a fuel tank, and one or more pumps that take a suction on the tank and deliver pressurized fuel to the fuel manifolds in the engine combustor via a main supply line. The main supply line may include one or more valves in flow series between the pumps and the fuel manifolds. These valves generally include at least a main metering valve and a pressurizing-and-shutoff valve downstream of the main metering valve. In addition to the main supply line, many fuel supply systems may also include a bypass flow line connected upstream of the metering valve that bypasses a portion of the fuel flowing in the main supply line back to the inlet of the one or more pumps, via a bypass valve. The position of the bypass valve is controlled to maintain a substantially fixed differential pressure across the main metering valve.
Many aircraft use a redundant channel engine control system to control engine operation and the fuel supply system. In particular, each of the redundant channels in the engine control system receives various input signals from the engine and aircraft and a thrust setting from the pilot. In response to these input signals, the engine control system may modulate the position of a main metering valve to control the fuel flow rate to the engine fuel manifolds to attain and/or maintain a desired thrust.
Fuel supply and engine control systems, such as the one described above, may experience certain postulated failure modes that may result in certain postulated effects. For example, two particular types of postulated failure mode effects include engine overspeed and asymmetric engine overthrust, which may each occur as a result of the same failure mode. It is postulated that an engine overspeed can lead to a turbine rotor disk burst. It is postulated that a sustained asymmetric overthrust condition while the aircraft is on the ground can, in some systems, cause the aircraft to exit the runway. It is further postulated that a sustained asymmetric overthrust condition while the aircraft is in the air and on final approach to the runway can, in other systems, cause an in-flight shutdown of the engine.
Various postulated system or component failures may cause an engine overspeed and/or overthrust condition. For example, a postulated failure in the engine control system or in the fuel supply system may cause significantly higher fuel flow than commanded to one of the engines. This higher fuel flow can cause an asymmetric overthrust condition, which in some instances may lead to an engine overspeed condition. Additional postulated failures that may lead to an asymmetric overthrust condition include a failure in the engine control system that causes the main metering valve to become fully-opened or to stick in a fully-opened or intermediate position, or the main metering valve may itself fail in a fully-opened or intermediate position. Other postulated failures that may lead to an engine overspeed include breaking of an engine shaft, such as the low pressure spool shaft.
To accommodate the above-described postulated failure modes, each channel in the engine control system may include monitoring and protection systems that operate independent of the main engine controller within the channel. This independence is provided to preclude a single postulated failure mode from either causing, or preventing protection from, an engine overspeed or engine overthrust event. While the use of redundant monitoring and protection channels is safe and reliable, it also exhibits certain drawbacks. For example, an aircraft may not be dispatched if one of the redundant channels becomes inoperable while the aircraft is on the ground.
Hence, there is a need for an engine monitoring and protection system that can accommodate various postulated failure modes, including engine overspeed and engine overthrust modes, that does not prevent aircraft dispatch even if a single channel is inoperable. The present invention addresses one or more of these needs.